feat(author): dirty-preserving same-claimant author-session rebind (#864) #865

2026-07-23T22:55:10-05:00

jcwalker3 commented

2026-07-23 22:55:10 -05:00

Summary

Closes #864.

Adds an explicit sanctioned recovery operation that rebinds a live author session to an already-registered dirty issue worktree when:

the durable lock still belongs to the same author identity/profile;
the recorded owner PID is provably dead;
ordinary gitea_lock_issue correctly refuses the dirty worktree;
manual lock/session editing remains forbidden.

This is the capability identified by the reconciler as:

BLOCKED + DIAGNOSE — OPERATOR REBIND CAPABILITY REQUIRED

It unblocks publication of PR #861 remediations without mutating the real #860 worktree in this PR.

Distinct from #860

#860 dirty-orphan recovery	This PR (session rebind)
PID-less / malformed locks	Recorded PID present and dead
May create recovery worktree + sync remote head	Acts only on registered dirty worktree
Re-applies dirty bytes onto recovery checkout	Preserves every byte in place
Heads may diverge	Local and remote heads must match pins

Capability and safety model

Tool: gitea_rebind_dirty_same_claimant_author_session
Full authoritative pins (remote/repo/issue/branch/worktree/claimant/profile/old PID/heads/dirty paths/fingerprints/competing ownership)
Journal-before-mutation; CAS lock generation; retry-safe already_rebound
Fingerprint verify immediately before and after rebind
Updates only stale lock/session provenance + live session pointer
Leaves repository, issue, branch, worktree, local head, remote head unchanged
Provenance source gitea_rebind_dirty_same_claimant_author_session is create-PR sanctioned
Dead-owner session pointers no longer force mutation workspace bindings for other issues (_session_author_lock_worktree)

Role restrictions

gitea-author: exact same claimant only
gitea-reconciler: assess + tightly pinned execute with authorize_reconciler_execute only; no commit/publication authority
reviewer / merger: refused
allowed=true is not ownership proof

Fail-closed cases

Live old PID; foreign/mismatched identity/profile; ambiguous ownership; unregistered/noncanonical/symlink paths; branch/issue/repo/path disagreement; head movement; dirty-path or fingerprint drift; competing session/lock/lease; malformed durable state; partial/replayed journal.

Ordinary dirty-worktree locking remains fail-closed.

Tests

pytest tests/test_dirty_same_claimant_session_rebind.py \
       tests/test_issue_lock_store.py \
       tests/test_issue_753_dead_pid_lock_recovery.py \
       tests/test_issue_772_unpublished_claim_recovery.py \
       tests/test_issue_lock_provenance.py -q
# 123 passed

Includes real-git integration coverage for success path, byte preservation, fingerprint pins, atomic session-pointer swap, retry, live/foreign/profile/competing/head/path/malformed refusals, ordinary dirty-lock fail-closed, and #860-class 7-path fixture (no real #860 mutation).

Non-mutation confirmation

Real #860 worktree and its preserved fingerprints were not rebound/cleaned/published by this work
PR #861 was not advanced by this PR
#850 / PR #853 / #855 untouched

Commit

a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23

Next role

gitea-reviewer for this bootstrap PR at the authoritative head above.

## Summary Closes #864. Adds an **explicit** sanctioned recovery operation that rebinds a live author session to an already-registered **dirty** issue worktree when: * the durable lock still belongs to the same author identity/profile; * the recorded owner PID is **provably dead**; * ordinary `gitea_lock_issue` correctly refuses the dirty worktree; * manual lock/session editing remains forbidden. This is the capability identified by the reconciler as: `BLOCKED + DIAGNOSE — OPERATOR REBIND CAPABILITY REQUIRED` It unblocks publication of PR #861 remediations without mutating the real #860 worktree in this PR. ## Distinct from #860 | #860 dirty-orphan recovery | This PR (session rebind) | |---|---| | PID-less / malformed locks | Recorded PID present and dead | | May create recovery worktree + sync remote head | Acts only on registered dirty worktree | | Re-applies dirty bytes onto recovery checkout | Preserves every byte **in place** | | Heads may diverge | Local and remote heads must match pins | ## Capability and safety model * Tool: `gitea_rebind_dirty_same_claimant_author_session` * Full authoritative pins (remote/repo/issue/branch/worktree/claimant/profile/old PID/heads/dirty paths/fingerprints/competing ownership) * Journal-before-mutation; CAS lock generation; retry-safe `already_rebound` * Fingerprint verify immediately before and after rebind * Updates only stale lock/session provenance + live session pointer * Leaves repository, issue, branch, worktree, local head, remote head unchanged * Provenance source `gitea_rebind_dirty_same_claimant_author_session` is create-PR sanctioned * Dead-owner session pointers no longer force mutation workspace bindings for other issues (`_session_author_lock_worktree`) ## Role restrictions * `gitea-author`: exact same claimant only * `gitea-reconciler`: assess + tightly pinned execute with `authorize_reconciler_execute` only; **no** commit/publication authority * reviewer / merger: refused * `allowed=true` is not ownership proof ## Fail-closed cases Live old PID; foreign/mismatched identity/profile; ambiguous ownership; unregistered/noncanonical/symlink paths; branch/issue/repo/path disagreement; head movement; dirty-path or fingerprint drift; competing session/lock/lease; malformed durable state; partial/replayed journal. Ordinary dirty-worktree locking remains fail-closed. ## Tests ```text pytest tests/test_dirty_same_claimant_session_rebind.py \ tests/test_issue_lock_store.py \ tests/test_issue_753_dead_pid_lock_recovery.py \ tests/test_issue_772_unpublished_claim_recovery.py \ tests/test_issue_lock_provenance.py -q # 123 passed ``` Includes real-git integration coverage for success path, byte preservation, fingerprint pins, atomic session-pointer swap, retry, live/foreign/profile/competing/head/path/malformed refusals, ordinary dirty-lock fail-closed, and #860-class 7-path fixture (no real #860 mutation). ## Non-mutation confirmation * Real #860 worktree and its preserved fingerprints were not rebound/cleaned/published by this work * PR #861 was not advanced by this PR * #850 / PR #853 / #855 untouched ## Commit `a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23` ## Next role **gitea-reviewer** for this bootstrap PR at the authoritative head above.

jcwalker3 added 1 commit 2026-07-23 22:55:10 -05:00

feat(author): add dirty-preserving same-claimant author-session rebind (Closes #864 ) a3f8f67c93

Introduce an explicit, fail-closed recovery operation that rebinds a live
author session to an already-registered dirty issue worktree when the durable
lock still belongs to the same identity/profile and the recorded owner PID is
provably dead. Ordinary locking remains clean-worktree-only; this path updates
only stale lock/session provenance, preserves every dirty byte under fingerprint
pins, and grants create-PR-sanctioned provenance without remote sync or recovery
worktrees.

Also stop treating dead-owner session pointers as live mutation workspace
bindings so a stale dead-owner pointer cannot poison unrelated author work.

jcwalker3 referenced this pull request

2026-07-23 22:56:03 -05:00

Add sanctioned dirty-preserving same-claimant author-session rebind #864

sysadmin commented

2026-07-23 23:42:54 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #865
issue: #864
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 70847-229338691d4f
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/fix-issue-864-dirty-same-claimant-session-rebind
phase: claimed
candidate_head: a3f8f67c93
target_branch: master
target_branch_sha: 6d0015cabc
last_activity: 2026-07-24T04:42:53Z
expires_at: 2026-07-24T04:52:53Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #865 issue: #864 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 70847-229338691d4f worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/fix-issue-864-dirty-same-claimant-session-rebind phase: claimed candidate_head: a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23 target_branch: master target_branch_sha: 6d0015cabcfc9f1ec95e1ca8674dcb072ea9e81a last_activity: 2026-07-24T04:42:53Z expires_at: 2026-07-24T04:52:53Z blocker: none

sysadmin approved these changes 2026-07-23 23:44:34 -05:00

sysadmin left a comment

Canonical PR State

STATE: reviewed-approved
WHO_IS_NEXT: merger
NEXT_ACTION: gitea-merger acquires a merger PR lease and merges PR #865 into master at head a3f8f67c93 on explicit approval. Approval is head-scoped and becomes invalid if the head moves.
NEXT_PROMPT:

You are gitea-merger for Scaled-Tech-Consulting/Gitea-Tools (remote prgs). Merge PR #865 (Closes #864) at authoritative head a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23, base master 6d0015cabcfc9f1ec95e1ca8674dcb072ea9e81a. It carries a fresh head-scoped APPROVE from prgs-reviewer sysadmin. Re-pin the live head with assess_pr_sync_status; if it still equals a3f8f67c, acquire the merger PR lease, resolve the merge capability, and merge. Do not merge if the head moved.

WHAT_HAPPENED: Independent gitea-reviewer review of bootstrap PR #865. Read the new module and MCP wiring line by line and independently ran the full claimed test suite (123 passed) at the pinned head. Verdict APPROVE.
WHY: The author same-claimant rebind path — the actual unblock for PR #861 remediation by jcwalker3 — is correct, safe, and fail-closed. Role and identity are derived server-side (not caller-spoofable), so no foreign-author worktree hijack is possible. Byte preservation is enforced by disk-observed fingerprints compared to caller pins (pins cannot be made tautological), with pre-bind and post-bind re-verification. Fail-closed coverage is comprehensive; journal-before-mutation + CAS generation; ordinary gitea_lock_issue dirty refusal is not weakened. Scope is clean and matches issue #864 exactly.
ISSUE: 864
HEAD_SHA: a3f8f67c93
REVIEW_STATUS: APPROVE
MERGE_READY: yes — 0 behind base, no conflicts, mergeable, checks not required; approval head-scoped to a3f8f67c
BLOCKERS: none

Non-blocking follow-ups (do NOT block this bootstrap PR — all fail CLOSED, no safety regression):

Reconciler-execute path is unreachable via the MCP tool: it hardwires claimant_identity/claimant_profile to the caller's own authenticated identity, but assess requires pin_identity == locked_identity, so a reconciler (sysadmin/prgs-reconciler) never matches the recorded author claimant (jcwalker3/prgs-author) and always REFUSES. Advertised in docstring/body but has no positive path and no positive test (only test_reconciler_without_authorize_refused). Fix: derive the reconciler-path pins from the recorded lock claimant, or drop the reconciler-execute claim. Fails loud/safe.
Post-bind fingerprint drift returns success:false while the lock is already rebound (torn state; journal records it). Consider explicit rollback or a rebound_but_unverified signal.
Nits: parse_dirty_paths has two identical line[3:].strip() branches; collect_dirty_inventory returns non-realpath worktree_path on error branches vs realpath on success. Cosmetic.

VALIDATION: pytest tests/test_dirty_same_claimant_session_rebind.py tests/test_issue_lock_store.py tests/test_issue_753_dead_pid_lock_recovery.py tests/test_issue_772_unpublished_claim_recovery.py tests/test_issue_lock_provenance.py -> 123 passed (run locally at a3f8f67c). No local edits, no code mutations by this review.
LAST_UPDATED_BY: gitea-reviewer sysadmin/prgs-reviewer

NATIVE_REVIEW_PROOF: workflow=review-merge-pr hash=263d0a6cb8a6 schema=b6c65affc336; reviewer=sysadmin/prgs-reviewer; head=a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23; lease_comment=15350; verdict=APPROVE.

## Canonical PR State STATE: reviewed-approved WHO_IS_NEXT: merger NEXT_ACTION: gitea-merger acquires a merger PR lease and merges PR #865 into master at head a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23 on explicit approval. Approval is head-scoped and becomes invalid if the head moves. NEXT_PROMPT: ```text You are gitea-merger for Scaled-Tech-Consulting/Gitea-Tools (remote prgs). Merge PR #865 (Closes #864) at authoritative head a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23, base master 6d0015cabcfc9f1ec95e1ca8674dcb072ea9e81a. It carries a fresh head-scoped APPROVE from prgs-reviewer sysadmin. Re-pin the live head with assess_pr_sync_status; if it still equals a3f8f67c, acquire the merger PR lease, resolve the merge capability, and merge. Do not merge if the head moved. ``` WHAT_HAPPENED: Independent gitea-reviewer review of bootstrap PR #865. Read the new module and MCP wiring line by line and independently ran the full claimed test suite (123 passed) at the pinned head. Verdict APPROVE. WHY: The author same-claimant rebind path — the actual unblock for PR #861 remediation by jcwalker3 — is correct, safe, and fail-closed. Role and identity are derived server-side (not caller-spoofable), so no foreign-author worktree hijack is possible. Byte preservation is enforced by disk-observed fingerprints compared to caller pins (pins cannot be made tautological), with pre-bind and post-bind re-verification. Fail-closed coverage is comprehensive; journal-before-mutation + CAS generation; ordinary gitea_lock_issue dirty refusal is not weakened. Scope is clean and matches issue #864 exactly. ISSUE: 864 HEAD_SHA: a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23 REVIEW_STATUS: APPROVE MERGE_READY: yes — 0 behind base, no conflicts, mergeable, checks not required; approval head-scoped to a3f8f67c BLOCKERS: none Non-blocking follow-ups (do NOT block this bootstrap PR — all fail CLOSED, no safety regression): 1. Reconciler-execute path is unreachable via the MCP tool: it hardwires claimant_identity/claimant_profile to the caller's own authenticated identity, but assess requires pin_identity == locked_identity, so a reconciler (sysadmin/prgs-reconciler) never matches the recorded author claimant (jcwalker3/prgs-author) and always REFUSES. Advertised in docstring/body but has no positive path and no positive test (only test_reconciler_without_authorize_refused). Fix: derive the reconciler-path pins from the recorded lock claimant, or drop the reconciler-execute claim. Fails loud/safe. 2. Post-bind fingerprint drift returns success:false while the lock is already rebound (torn state; journal records it). Consider explicit rollback or a rebound_but_unverified signal. 3. Nits: parse_dirty_paths has two identical line[3:].strip() branches; collect_dirty_inventory returns non-realpath worktree_path on error branches vs realpath on success. Cosmetic. VALIDATION: pytest tests/test_dirty_same_claimant_session_rebind.py tests/test_issue_lock_store.py tests/test_issue_753_dead_pid_lock_recovery.py tests/test_issue_772_unpublished_claim_recovery.py tests/test_issue_lock_provenance.py -> 123 passed (run locally at a3f8f67c). No local edits, no code mutations by this review. LAST_UPDATED_BY: gitea-reviewer sysadmin/prgs-reviewer NATIVE_REVIEW_PROOF: workflow=review-merge-pr hash=263d0a6cb8a6 schema=b6c65affc336; reviewer=sysadmin/prgs-reviewer; head=a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23; lease_comment=15350; verdict=APPROVE.

sysadmin commented

2026-07-23 23:54:18 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #865
issue: #864
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 70855-19a097c3ea0f
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/fix-issue-864-dirty-same-claimant-session-rebind
phase: claimed
candidate_head: a3f8f67c93
target_branch: master
target_branch_sha: 6d0015cabc
last_activity: 2026-07-24T04:54:18Z
expires_at: 2026-07-24T05:04:18Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #865 issue: #864 reviewer_identity: sysadmin profile: prgs-merger session_id: 70855-19a097c3ea0f worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/fix-issue-864-dirty-same-claimant-session-rebind phase: claimed candidate_head: a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23 target_branch: master target_branch_sha: 6d0015cabcfc9f1ec95e1ca8674dcb072ea9e81a last_activity: 2026-07-24T04:54:18Z expires_at: 2026-07-24T05:04:18Z blocker: none

sysadmin merged commit ef14622ba0 into master

2026-07-23 23:55:02 -05:00

sysadmin commented

2026-07-23 23:55:10 -05:00

Stale #332 review-decision lock cleanup (#594)

Status: APPLIED

actor: sysadmin
profile: prgs-merger
timestamp: 2026-07-24T04:55:09.988254+00:00
last terminal: approve on PR feat(author): dirty-preserving same-claimant author-session rebind (#864) (#865)
PR state: closed (merged=True)
merge_commit_sha: ef14622ba0badd0cd7d654c05af13aca7d81bc05
prior live_mutations_count: 1
prior profile_identity: prgs-reviewer

Manual deletion of session-state files is not the workflow.
This path only clears a lock when the referenced PR is merged/closed.

## Stale #332 review-decision lock cleanup (#594) Status: **APPLIED** - actor: `sysadmin` - profile: `prgs-merger` - timestamp: `2026-07-24T04:55:09.988254+00:00` - last terminal: `approve` on PR #865 - PR state: `closed` (merged=True) - merge_commit_sha: `ef14622ba0badd0cd7d654c05af13aca7d81bc05` - prior live_mutations_count: `1` - prior profile_identity: `prgs-reviewer` Manual deletion of session-state files is **not** the workflow. This path only clears a lock when the referenced PR is merged/closed.

jcwalker3 referenced this pull request

2026-07-24 00:06:57 -05:00

Harden dirty-session rebind inventory and journal identity #868

jcwalker3 referenced this pull request

2026-07-24 00:14:31 -05:00

fix(author): harden dirty-session rebind inventory and journal identity (#868) #869

jcwalker3 referenced this pull request

2026-07-24 00:16:09 -05:00

fix(author): harden dirty-session rebind inventory and journal identity (#868) #869

jcwalker3 referenced this pull request

2026-07-24 00:16:27 -05:00

Harden dirty-session rebind inventory and journal identity #868